The U.S. spy agency CIA has pulled most of its operatives from the U.S. Embassy in China after two massive cyber attacks on the Office of Personnel Management (OPM) computers earlier this year. Though Washington has refused to publicly blame China for the cyber theft, officials believe that Chinese government was behind the attacks.
CIA takes a precautionary measure
CIA’s move was a precautionary measure as the hacks exposed personal records of 22 million U.S. government employees. OPM said the records contained security clearance background checks as well as 5.6 million fingerprints, reports the Washington Post. China could use the massive data to identify American spies, and then recruit them or blackmail them to provide sensitive information.
Officials told the Washington Post that Beijing could have compared the stolen OPM records with the list of Embassy personnel. Any official not on that list could be a CIA agent. The CIA’s decision to pull out its operatives was meant to safeguard agents whose affiliation to the agency might have been discovered.
What if China carried out another OPM-like attack?
Testifying before the Senate Armed Services Committee, the Director of National Intelligence James Clapper said the intelligence agencies didn’t know exactly whose personal records were stolen. But the scale of the breach has “very serious implications.” He said it posed huge risks to the U.S. intelligence gathering. Clapper said the U.S. also practices cyberespionage “and we are not bad at it.”
When asked what response he would recommend if China carried out another OPM-like cyber attack, the Deputy Defense Secretary Robert O. Work said it could be either sanctions or retaliation, or a combination of the two. Meanwhile, Chinese Foreign Ministry spokesman Hong Lei denied Beijing’s involvement in hacking. Lei said the Chinese government opposed any form of hacking.
The U.S. counterintelligence officials said in August that Russia and China were aggregating and cross-indexing data they had stolen by breaching into computers of the U.S. government and private entities.